[
https://issues.apache.org/jira/browse/KNOX-3429?focusedWorklogId=1039037&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1039037
]
ASF GitHub Bot logged work on KNOX-3429:
----------------------------------------
Author: ASF GitHub Bot
Created on: 01/Sep/26 10:05
Start Date: 01/Sep/26 10:05
Worklog Time Spent: 10m
Work Description: smolnar82 opened a new pull request, #1368:
URL: https://github.com/apache/knox/pull/1368
[KNOX-3429](https://issues.apache.org/jira/browse/KNOX-3429) - Harden source
assembly to exclude build caches, runtime state, and staging dir
## What changes were proposed in this pull request?
`src/assembly.xml` includes `**` from the repo root and excluded only
`target/`, `node_modules/`, and `IDE files`. Since it snapshots the working
tree at end-of-build, leftover artifacts get bundled into
`knox-<version>-src.zip` - bloating it (staging then fails with `svn E175002`
on the `dist` repo) and shipping generated `keystores/credentials` in a source
release.
Adds scoped excludes:
- .angular/.scannerwork caches
- candidate/** (re-bundled a previous *-src.zip)
- runtime state outside target/ (data/{security,ldap-server,deployments},
logs, *.pid)
- and JVM crash/heap dumps.
Kept narrow (**/logs/*.log not **/*.log) to drop no tracked source. Safety
net only - staging from a clean checkout remains recommended.
How was this patch tested?
```
- xmllint --noout src/assembly.xml passes.
- git ls-files confirms no new pattern matches tracked source (preserves
home/data/**/README, home/logs/.gitignore, sample .log).
- Clean-checkout build already yields the correct ~38 MB zip; excludes now
make a dirty tree produce the same.
```
Integration Tests
N/A
UI changes
N/A
Issue Time Tracking
-------------------
Worklog Id: (was: 1039037)
Remaining Estimate: 0h
Time Spent: 10m
> knox-<version>-src.zip can balloon far beyond its expected size (~40 MB ->
> GBs) and fail to stage to the Apache dist repo.
> --------------------------------------------------------------------------------------------------------------------------
>
> Key: KNOX-3429
> URL: https://issues.apache.org/jira/browse/KNOX-3429
> Project: Apache Knox
> Issue Type: Bug
> Components: Build, Release
> Affects Versions: 3.0.0
> Reporter: Sandor Molnar
> Assignee: Sandor Molnar
> Priority: Major
> Fix For: 3.1.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {noformat}
> ant stage-candidate fails uploading the source archive:
> svn: E175002: PUT request on
> '.../dev/knox/knox-<version>/knox-<version>-src.zip' failed
> The PUT is rejected because the source zip is oversized.
> {noformat}
> *Root cause:* {{src/assembly.xml}} includes {{**}} from the repo root and
> subtracts only a short exclude list ({{target, node_modules, IDE files}}).
> The assembly snapshots the working tree at end-of-build, so anything else
> present gets bundled: Angular caches (.angular), runtime state generated by
> running the gateway/tests outside target/ (data/security keystores,
> data/ldap-server, data/deployments, logs, *.pid), JVM crash/heap dumps, and
> the {{candidate/}} staging dir (which re-bundles a previous *-src.zip).
> Shipping generated {{keystores/credentials}} in a source release is also a
> hygiene issue. A clean checkout builds correctly, so the logic is sound - the
> descriptor just isn't robust to leftover artifacts.
> *Fix:* Add scoped excludes to src/assembly.xml:
> {noformat}
> **/.angular/**, **/.scannerwork/**, candidate/**,
> **/data/{security,deployments,ldap-server}/**, **/logs/*.{log,out,err},
> **/*.pid, **/*.hprof, **/hs_err_pid*.log, **/replay_pid*.log. Patterns kept
> narrow and verified via git ls-files to drop no tracked source (preserving
> home/data/**/README, home/logs/.gitignore, sample .log).
> {noformat}
> *Acceptance Criteria*
> - Source zip stays ~40 MB even when built from a tree with runtime state /
> populated candidate/.
> - No generated keystores/credentials in the archive; no legitimate tracked
> files dropped.
> - ant stage-candidate uploads successfully.
> *Note*
> Excludes are a safety net - staging from a clean checkout remains the
> recommended practice.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
